Role common: add task sftpd.yml for chrooted SFTP access.

- group 'sftpusers' (GID 200 or next free), sshd drop-in
  /etc/ssh/sshd_config.d/90-sshd-SFTP.conf (Match Group, ChrootDirectory %h,
  ForceCommand internal-sftp), PasswordAuthentication via
  'sftp_password_authentication'
- new sftp users (UID 201 or next free) with root owned chroot home,
  upload dir and root owned authorized_keys (always created)
- existing users (e.g. www-data, suexec users) can be added to the group;
  chroot requirements of their home are checked, not changed
- passwords: update_password defaults to 'always', password of users with
  shell access is never changed
- controlled by 'chrooted_sftpd_present' (default: false), tag 'sftpd'
- add empty sftpd section to all host_vars *-common.yml

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
2026-11-14 10:42:42 +01:00
co-authored by Claude Opus 5.5
parent 2b5bffe2be
commit 67c1086e2c
179 changed files with 1376 additions and 0 deletions
+5
View File
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
+5
View File
@@ -66,6 +66,11 @@ extra_user:
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
@@ -21,6 +21,11 @@
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
+5
View File
@@ -21,6 +21,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
@@ -58,6 +58,11 @@ network_interfaces:
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
+5
View File
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
+5
View File
@@ -60,6 +60,11 @@ extra_user:
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
@@ -49,6 +49,11 @@ root_ssh_keypair:
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -59,6 +59,11 @@ root_ssh_keypair:
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
+5
View File
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -21,6 +21,11 @@
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
@@ -21,6 +21,11 @@
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
@@ -21,6 +21,11 @@
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
@@ -21,6 +21,11 @@
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
@@ -21,6 +21,11 @@
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
@@ -21,6 +21,11 @@
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
@@ -9,6 +9,11 @@
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
@@ -21,6 +21,11 @@
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
@@ -21,6 +21,11 @@
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
@@ -21,6 +21,11 @@
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
@@ -21,6 +21,11 @@
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
@@ -21,6 +21,11 @@
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
@@ -21,6 +21,11 @@
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
@@ -21,6 +21,11 @@
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
+5
View File
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -21,6 +21,11 @@
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
@@ -25,6 +25,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -25,6 +25,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -25,6 +25,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -25,6 +25,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -25,6 +25,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
+5
View File
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -93,6 +93,11 @@ network_interfaces:
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -90,6 +90,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-256
- ssh-rsa
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -68,6 +68,11 @@ network_interfaces:
# vars used by roles/common/tasks/sshd.yml
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -92,6 +92,11 @@ network_interfaces:
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -69,6 +69,11 @@ network_interfaces:
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -68,6 +68,11 @@ network_interfaces:
# vars used by roles/common/tasks/sshd.yml
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -25,6 +25,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -89,6 +89,11 @@ network_interfaces:
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -80,6 +80,11 @@ network_interfaces:
# vars used by roles/common/tasks/sshd.yml
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -25,6 +25,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
+5
View File
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -270,6 +270,11 @@ network_interfaces:
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -94,6 +94,11 @@ sudo_users:
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/sudoers.yml
# ---
@@ -94,6 +94,11 @@ sudo_users:
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/sudoers.yml
# ---
@@ -74,6 +74,11 @@ sudo_users:
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -146,6 +146,11 @@ cron_user_special_time_entries:
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -150,6 +150,11 @@ cron_user_special_time_entries:
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -24,6 +24,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -320,6 +320,11 @@ network_interfaces:
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -94,6 +94,11 @@ sudo_users:
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/sudoers.yml
# ---
@@ -166,6 +166,11 @@ sudo_users:
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/sudoers.yml
# ---
@@ -121,6 +121,11 @@ network_interfaces:
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
+5
View File
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -36,6 +36,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -31,6 +31,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -81,6 +81,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -36,6 +36,11 @@ copy_additional_plain_files_sysctl:
# - rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -36,6 +36,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -146,6 +146,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -183,6 +183,11 @@ cron_user_special_time_entries:
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -27,6 +27,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-256-cert-v01@openssh.com
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -36,6 +36,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -77,6 +77,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -77,6 +77,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -147,6 +147,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -85,6 +85,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -145,6 +145,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -98,6 +98,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -142,6 +142,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -133,6 +133,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -132,6 +132,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -98,6 +98,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -81,6 +81,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -36,6 +36,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -36,6 +36,11 @@ sshd_hostkeyalgorithms:
- rsa-sha2-512-cert-v01@openssh.com
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
+5
View File
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -25,6 +25,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -25,6 +25,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -28,6 +28,11 @@ sshd_pubkey_authentication: !!str "yes"
sshd_password_authentication: !!str "yes"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
+5
View File
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -25,6 +25,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
+5
View File
@@ -21,6 +21,11 @@
sshd_permit_root_login: !!str "prohibit-password"
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by apt.yml
# ---
+5
View File
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
+5
View File
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---
+5
View File
@@ -20,6 +20,11 @@
# ---
# ---
# vars used by roles/common/tasks/sftpd.yml
# ---
# ---
# vars used by roles/common/tasks/apt.yml
# ---

Some files were not shown because too many files have changed in this diff Show More